The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.

Published Aug 27, 2019 · Updated Aug 6, 2024 · Assigned by mitre